Ronin Network and Sky Mavis have pledged to update their smart contracts, offer lucrative bug bounties and increase security following the $600 million attack late last month.
As Cointelegraph previously reported, the Ethereum sidechain developed for the popular NFT game Axie Infinity was the victim of an exploit for 173,600 Ether (ETH) and 25.5 million USD Coin (USDC) worth over $612 million in value. that moment.
Earlier this month, the Federal Bureau of Investigation (FBI) attributed the attack to the North Korea-based, state-sponsored hacking group Lazurus, as it issued a warning to other cryptocurrency and blockchain organizations.
Ronin announced the changes to its platform via a post-mortem report released yesterday, noting that all user funds are in the process of being restored as it vowed to ensure this “never happens again.”
We have put together an autopsy on the Ronin exploit that occurred on March 23.
• Why it happened— Ronin (@Ronin_Network) April 27, 2022
• What we are doing to make sure this never happens again
• Update on the reopening of the Ronin Bridgehttps://t.co/FfwCtCG84E
The trick is over
The hack was the result of a spear phishing attack against a former employee of Sky Mavis (developers of Axie Infinity). The bad actor was able to leverage the employee’s credentials to access all four Sky Mavis validation nodes out of a total of nine in the Axie/Ronin ecosystem.
This alone was not enough to cause any damage, but “the attacker found a backdoor through our gasless RPC node, which they abused to obtain the Axie DAO validator signature.”
“This dates back to November 2021 when Sky Mavis requested help from Axie DAO to distribute free transactions due to immense user load. Axie DAO listed Sky Mavis as allowed to sign various transactions on their behalf. This was discontinued in December 2021, but access to the allow list was not revoked,” the report says.
Following the hack, major changes are being implemented on both Sky Mavis and the Ronin Network.
Ronin Network hopes to have its bridge open again in mid to late May, with Binance providing support until then with withdrawal and deposit infrastructure for Axie users.
The team is about 80% complete on the Ronin Bridge smart contracts update, will be reworking the backend, migrating all pending withdrawals, and launching a validation panel that “allows large transactions to be approved and new validators to be added/removed” .
“The Ronin Network bridge is currently undergoing a redesign and will open once we are confident it can stand the test of time. We initially hoped to be able to roll out the update by the end of April, but this is not a process we can afford to rush.”
Related: Binance Recovers $5.8M in Funds Related to Ronin Bridge Exploit
Sky Mavis will increase its security measures by seeking the help of “first level security experts”, conducting contract audits and implementing stricter internal procedures, such as training courses to “combat external threats”.
Notably, it will also significantly increase its number of nodes to help decentralize the project. Having already increased from nine to 11, Sky Mavis intends to increase that number to 21 within three months. In the longer term, the project contemplates more than 100 nodes.
Sky Mavis will also be releasing bug bounties of up to $1 million for any white hat hacker who can find more vulnerabilities.
“We recognize the importance and value of the efforts of security researchers to help keep our community safe. Sky Mavis is offering rewards of up to $1 million to encourage responsible disclosure of security vulnerabilities.”